azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wiki(IMC): 2026-07-07 fleet reconciliation — Datto EDR rollout, AV vendor, backup/billing gap, retire list

Browse Source 
- AV/EDR is Datto (not Bitdefender); REPAIRADMIN BD->EDR swap in progress
- EDR deployed to BigMom + DESKTOP-NFU17AJ; queued LUIS/EdServices1/REPAIRADMIN
- DESKTOP-NFU17AJ enrolled in RMM (17->18); 4 more queued via SC
- MSP360 backup live-but-unbilled on IMC1; AV billed 20 seats
- 12 Syncro assets to archive (>40d offline; archive=UI-only)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Howard Enos
2026-07-07 20:45:53 -07:00
parent 09ab3de106
commit 840b0ce9d6
1 changed files with 81 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
wiki/clients/instrumental-music-center.md
View File

@@ -149,6 +149,64 @@ office desktops), Department kept as "Sales".
**Note:** When SSH from Howard-Home is blocked by the 192.168.0.0/24 route collision, GuruRMM remote commands are the fallback for running diagnostics on IMC1. **Note:** When SSH from Howard-Home is blocked by the 192.168.0.0/24 route collision, GuruRMM remote commands are the fallback for running diagnostics on IMC1.
### 2026-07-07 fleet reconciliation (RMM / AV / backup / Syncro assets)
Cross-referenced GuruRMM vs ScreenConnect vs Datto EDR vs MSP360 vs Syncro assets for IMC.
**Site rule:** Main = public IP `72.194.57.2` (Speedway); MOO = `68.107.177.170`; anything
else defaults to Main. ScreenConnect CP1 = `IMC - Instrumental Music Center`, CP2 = Site
(SC truncates Name to 15 chars, e.g. `IMC-M-EDSERVICE` == RMM `IMC-M-EdServices1`).
**GuruRMM enrollments added/queued 2026-07-07 (all Main unless noted):**
- **Enrolled + verified:** `DESKTOP-NFU17AJ` (agent count 17 -> 18).
- **Queued via ScreenConnect** (single self-contained `iex (irm .../install/INNER-BRIDGE-8354/windows)`
in the session's one command slot; runs on reconnect): `DESKTOP-KRHQ5TS` (Manda),
`SNAPPERLANDHOME` (Sara Sherer), `LAPTOP-PNVA9G51`, `LESLIE2019LAPTO` (Leslie's events laptop).
## Security — AntiVirus / EDR
**IMC's AV/EDR is Datto AV/EDR (Infocyte), NOT Bitdefender.** Datto org **Instrumental Music
Center** `00b6b6e9-35ea-47cd-9413-088776434514`, single scan-target group **IMC - Speedway
(Loc1)** `c56026f0-b174-4f84-9dc4-cf8cffa49b74`, enrollment **RegKey `instrume01`** (all IMC
endpoints — incl. MOO — land in this one org/group). Deploy one-liner: `Install-EDR -URL
"https://azcomp4587.infocyte.com" -RegKey instrume01` (push via `/rmm`, or queue via SC
send-command for an offline box).
- **Bitdefender is being retired from IMC.** Only one IMC endpoint was ever on Bitdefender
GravityZone — `REPAIRADMIN` (BD company `5e77afc47357486d522f1a44`, BEST agent, anti-tamper
ON). **BD has NO uninstall API** (GravityZone console/local-tool only); policy has a blank
uninstall password (`shouldAskForPassword: false`), so removal = push BD's local uninstall
tool via `/rmm`. **Swap order: install + verify Datto EDR FIRST, then pull Bitdefender**
(no unprotected window).
- **EDR deployed 2026-07-07:** `BigMom` (MOO) + `DESKTOP-NFU17AJ` (Main) — installed, exit 0,
registered (Datto org 16 -> 18). **Queued via SC** (offline): `IMC-LUIS` (MOO),
`IMC-M-EdServices1` (Main), `REPAIRADMIN` (EDR then BD removal).
- **Still to cover:** the 4 SC-queued RMM enrollments above get EDR *after* they land in
GuruRMM (their one SC slot currently holds the RMM installer).
- **3 dead Datto agents** (`desktop-urv3ugr`, `office1`, `purchasingcomp`) = retire-list
machines; clear when their Syncro assets are archived.
## Billing (Syncro) — AV yes, Backup unbilled
Syncro customer **7088508**; one monthly recurring schedule **#365662** ("GPS/AV/365/Monthly
services - Leslie Stirm", $1,590.02/mo). Relevant lines:
- **AntiVirus: BILLED** — `GPS AntiVirus Add-on` 20 x $5 = **$100/mo** (20 seats). `GPS basic`
also bundles AV in its description — possible partial double-charge, worth a sanity check.
- **Backup: NOT billed** — no MSP360/Cloudberry/backup line on the invoice, and `GPS basic`'s
inclusion list does not cover backup. **IMC1 IS backing up (unbilled) — revenue gap.**
- Other lines: `GPS basic` 18 x $20, `GPS Pro Server` 2 x $80, Pax8 M365 (5), Hardware-Mgmt
fees, PacketDial VoIP.
- **AV seat reconciliation:** 20 billed vs ~14 actually protected (13 live Datto + 1 BD) at
audit time; the 2026-07-07 EDR rollout closes the gap by covering the previously-unprotected
live machines (`BigMom`, `IMC-LUIS`, `IMC-M-EdServices1`, `DESKTOP-NFU17AJ`, + REPAIRADMIN swap).
**Syncro asset retirement (offline > 40 days):** Syncro "retire" = **Archive** — **UI-only, no
REST API** (never `DELETE` — loses history/ticket links). 12 assets qualify (archive via Assets
tab -> Bulk Actions -> Archive): `PHIL2021LAPTOP` (5345521), `IMC-EVENTS` (5033192),
`DESKTOP-JQ0D38J` (10333758), `DESKTOP-URV3UGR` (2486998), `PURCHASINGCOMP` (2967905), `PHIL`
(3100580), `IMC-L1-GRAPHICS` (2451117), `DNW-L8-1..4` (3151232/234/242/229), `DNW-L24`
(3150899). Kept (< 40d): `LAPTOP-PNVA9G51`, `DESKTOP-KRHQ5TS`, `IMC-PRINTSERVER`.
--- ---
## Access ## Access
@@ -189,6 +247,13 @@ office desktops), Department kept as "Sales".
- **Retention task:** `IMC AIMsi Backup Retention` — daily 23:30, SYSTEM, 1-hour limit - **Retention task:** `IMC AIMsi Backup Retention` — daily 23:30, SYSTEM, 1-hour limit
- **Off-site:** Cloudberry / MSP360 at `C:\ProgramData\Online Backup\`. Cloudberry chain confirmed intact before 2026-04-12 deletion run. - **Off-site:** Cloudberry / MSP360 at `C:\ProgramData\Online Backup\`. Cloudberry chain confirmed intact before 2026-04-12 deletion run.
- SQLEXPRESS backup also confirmed landing at `C:\ProgramData\Online Backup\MSSQL\IMC1_SQLEXPRESS\` - SQLEXPRESS backup also confirmed landing at `C:\ProgramData\Online Backup\MSSQL\IMC1_SQLEXPRESS\`
- **MSP360 live status (verified 2026-07-07, company "Instrumental Music"):** IMC1 has 3 plans —
`Amisi Server - Files` **Success, ran daily** (last 2026-07-07 07:00, ~3.8 GB); `Backup MS SQL
Server` **ran daily but "completed with warnings"** (last 2026-07-07 21:00) — warning
`LsnDoNotMatchBeforeDiff` forces a full backup of `IMCAIM` because the local nightly SQL job
(22:00) and MSP360's diff chain compete for the log chain (align the two jobs to stop the churn);
`Amisi Server - Images` **stale — last ran 2024-10-24** (~20 mo; decide keep-or-drop). **Backup is
live but NOT billed** — see Billing. [Backup remediation tracked in a separate plan.]
- **Windows Image Backup:** on F: - **Windows Image Backup:** on F:
- **AIMSQL orphan:** no backup chain. Locate and back up `AIM.mdf`, `IMC.mdf`, `TestConv61223.mdf` and their `.ldf` siblings before any consolidation — files were not found in expected path under `MSSQL15.AIMSQL\MSSQL\DATA` or `S:\*AIMSQL*` during 2026-05-06 search. - **AIMSQL orphan:** no backup chain. Locate and back up `AIM.mdf`, `IMC.mdf`, `TestConv61223.mdf` and their `.ldf` siblings before any consolidation — files were not found in expected path under `MSSQL15.AIMSQL\MSSQL\DATA` or `S:\*AIMSQL*` during 2026-05-06 search.
@@ -275,6 +340,21 @@ Extended support ends **2027-01-12**. Migration window is finite. The memory pre
## Active Work ## Active Work
As of 2026-07-07 (fleet reconciliation):
1. **[PENDING] REPAIRADMIN Bitdefender -> Datto EDR swap** — EDR install queued via SC; when
the box next comes online, verify EDR live, then push BD's local uninstall tool via `/rmm`
(blank uninstall password) and delete the stale BD console entry.
2. **[PENDING] EDR on the SC-queued RMM enrollments** — after `DESKTOP-KRHQ5TS` (Manda),
`SNAPPERLANDHOME` (Sara), `LAPTOP-PNVA9G51`, `LESLIE2019LAPTO` land in GuruRMM, push Datto
EDR to each (their one SC slot currently holds the RMM installer).
3. **[PENDING - user] Archive 12 offline-> 40d Syncro assets** — UI-only (Assets -> Bulk
Actions -> Archive); list in Billing section above. Then remove the 3 matching dead Datto
agents.
4. **[SEPARATE PLAN] Backup billing + SQL diff-chain churn** — IMC1 backs up but isn't billed;
`Amisi Server - Images` plan stale since 2024-10; SQL diff chain competes with the local
22:00 job. Being handled in a separate backup plan.
As of 2026-05-07 (last decision recorded): As of 2026-05-07 (last decision recorded):
1. **[IMMEDIATE] Apply `max server memory` caps on IMC1 SQL instances** — Mike approved 2026-05-07. Howard to implement: SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB. Reversible (1-second config change, no service restart). Until applied, AIM connection-broken errors will continue recurring. [unverified — confirm applied] 1. **[IMMEDIATE] Apply `max server memory` caps on IMC1 SQL instances** — Mike approved 2026-05-07. Howard to implement: SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB. Reversible (1-second config change, no service restart). Until applied, AIM connection-broken errors will continue recurring. [unverified — confirm applied]
@@ -313,6 +393,7 @@ As of 2026-05-07 (last decision recorded):
| 2026-05-06 | Howard | Station 1 recurrence 12:14 PM. Full instance enumeration revealed SQLEXPRESS = production Standard (not AIMSQL). Wrong-instance restart task unregistered. Corrected diagnosis in session logs and PROJECT_STATE. Feedback memory created. | | 2026-05-06 | Howard | Station 1 recurrence 12:14 PM. Full instance enumeration revealed SQLEXPRESS = production Standard (not AIMSQL). Wrong-instance restart task unregistered. Corrected diagnosis in session logs and PROJECT_STATE. Feedback memory created. |
| 2026-05-07 | Mike | Decision: approved memory caps (SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB), AIMSQL consolidation pending backup, Server 2016 migration timeline acknowledged, WSUS confirmed unused. | | 2026-05-07 | Mike | Decision: approved memory caps (SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB), AIMSQL consolidation pending backup, Server 2016 migration timeline acknowledged, WSUS confirmed unused. |
| 2026-07-07 | Howard | **Two-location split**: renamed GuruRMM site `IMCMain` -> **Main**, created **MOO** site (`SILVER-BRIDGE-5118`, key vaulted). Moved DESKTOP-GHG12G3 + IMC-LUIS to MOO; enrolled BigMom (was ScreenConnect-only) into MOO. Marked all machines in ScreenConnect (Company/Site + Front/Office location tags). Main = 14 agents, MOO = 3. | | 2026-07-07 | Howard | **Two-location split**: renamed GuruRMM site `IMCMain` -> **Main**, created **MOO** site (`SILVER-BRIDGE-5118`, key vaulted). Moved DESKTOP-GHG12G3 + IMC-LUIS to MOO; enrolled BigMom (was ScreenConnect-only) into MOO. Marked all machines in ScreenConnect (Company/Site + Front/Office location tags). Main = 14 agents, MOO = 3. |
| 2026-07-07 (eve) | Howard | **Fleet reconciliation + EDR rollout.** Confirmed AV = Datto EDR (not BD); deployed EDR to BigMom + DESKTOP-NFU17AJ (Datto org 16->18), queued EDR to IMC-LUIS/IMC-M-EdServices1/REPAIRADMIN. Enrolled DESKTOP-NFU17AJ in RMM (17->18), queued RMM install for Manda/Sara/PNVA9G51/LESLIE. Started REPAIRADMIN BD->EDR swap (EDR queued; BD removal pending EDR verify). Found MSP360 backup live-but-unbilled on IMC1; AV billed 20 seats. Identified 12 Syncro assets to archive (>40d offline). |
--- ---